Top Risks

• Uninstall and install URL hijack both active — tracks user lifecycle for traffic monetization.
• New-tab override replaces every new tab with wallpaper/search surface; high reach monetization risk.
• Privacy policy fetch failed (HTTP error) — effective data-handling transparency is zero.
• No CSP declared (MV3 default applies, but dom_sink_innerhtml_userctrl in calendar.js is unmitigated).
• Developer name missing; search permission + newtab override creates search-interception capability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• privacy_policy_fetch_error api Fetch of https://gameograf.com/privacy-policy/ returned HTTPError; policy content unavailable.
• dom_sink_innerhtml_userctrl crx js/calendar.js: gridEl.innerHTML = html — DOM-XSS sink without CSP guard.
• no_developer_name store developer_name field is empty; accountability reduced.
• search_permission_with_newtab manifest 'search' permission combined with newtab override enables search interception / monetization.
• verified_publisher store Extension has verified_publisher=true on gameograf.com (resolves, age 2050d, 265 certs).

Permissions Breakdown

• search medium Allows reading/modifying search provider; combined with newtab override raises monetization risk.
• alarms low Schedules background tasks; low standalone risk.
• storage low Local data persistence; low risk.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach, monetization surface, search interception risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping